>Here's the patient information they want:

You are missing the page before:

>Non-specific patient demographics (gender; age group; city, state, and zip code of residence)

This doesn't seem HIPAA compliant according to the safe habor rules: https://www.hhs.gov/hipaa/for-professionals/privacy/special-...

It would also be almost impossible to use expert determination, for this is often done using statistical methods that are impossible to apply on changing datasets (such as k-anonymity).

edit: They also ask for an "encrypted patient identifier".